Options for more Granualar permissions to areas of Fabric Admin Portal

[ITmerrr]

Currently its not possible to manage access to Fabric via a custom role as Fabric permissions are not supported for custom roles.

It would be great to be able to grant granular access to areas in Fabric, currently this is only possible via an App registration/Delegated permissions, but is not possible for areas like 'tenant settings' as the API permissions for this is 'Tenant.ReadWrite.All' grants access to more areas than required.

[rohit1991 · Accepted solution]

Hi @ITmerrr ,

You've raised an important point. Currently, the limitation around custom roles not supporting Fabric-specific permissions does make it challenging to manage granular access—especially when dealing with sensitive areas like tenant settings. While there are some built-in layers of security in Fabric, such as workspace roles, item-level permissions, and OneLake data access controls, these do not fully address the need for fine-tuned administrative access.

As you mentioned, using delegated permissions via app registrations can help in some scenarios, but broader permissions like 'Tenant.ReadWrite.All' often grant more access than is necessary or desirable. This gap makes it difficult to follow the principle of least privilege. It would certainly be beneficial if Microsoft introduced more refined role-based access controls or scoped API permissions that target specific areas of the Fabric Admin Portal. Submitting this as feedback through the Microsoft Fabric Ideas portal might help bring more attention to the need for better administrative granularity.

Passionate about leveraging data analytics to drive strategic decision-making and foster business growth.

Connect with me on LinkedIn: Rohit Kumar.

[v-csrikanth]

Hi @ITmerrr 
I hope you have already rasie in the ideas forum.

If you are still facing any new issues related to Fabric and PowerBI forum do reach out to us in the community else can you mark the post as resolved. 

Looking forward to your reply!

Best Regards,
Community Support Team _ C Srikanth.

[v-csrikanth · Accepted solution]

Hi @ITmerrr 

Hello and a big thank you for taking the initiative to raise this idea in the Fabric Community! Your proactive contribution not only highlights important enhancements but also drives our product forward. I’ve just upvoted your suggestion and encourage others to do the same—your voice truly makes a difference.

If there’s anything more I can help with, just let me know!

Best Regards,
Community Support Team _ C Srikanth.

[ITmerrr]

In light of the limitations mentioned I have raised a Idea on the portal.

https://community.fabric.microsoft.com/t5/Fabric-Ideas/Options-for-more-Granualar-permissions-to-are...

Please upvote 😊

[GilbertQ]

Hi @ITmerrr 

You could look at using the new domain delegation settings available in the tenant settings here or more details. Domains - Microsoft Fabric | Microsoft Learn

[ITmerrr]

Hi thank you for your reply.

I have taken a look at the options available and unfortunately this doesnt allign with the requirements to assign access/permissions to areas of admin portal as noted.

Any other suggestions would be greatly appreciatted!  

Currently this feels like a limitation for most the areas listed in my reply below:

Areas to provide access:

-Tenant Settings (the only app permission provides to much access ('Tenant.ReadWrite.All' ))

-Usage Metrics

-Users

-Premier Per User

-Audit logs

-Workloads ( api permissions grants access to all )

-workspaces

Whilst not providing access to the rest of the admin portal.

[ITmerrr]

Thank you for your response, very much appreciated! 

I agree there is some level of granular permissions within PowerBi as you noted.

The requirement would be to provide access to the below areas whilst not providing access to the other areas in the Admin portal:

Areas to provide access:

-Tenant Settings (the only app permission provides to much access ('Tenant.ReadWrite.All' ))

-Usage Metrics

-Users

-Premier Per User

-Audit logs

-Workloads ( api permissions grants access to all )

-workspaces

Whilst not providing access to the rest of the admin portal.

Its not possible via custom roles as previouslt described, and via API permissions they are not granualar enough, for example ( 'Tenant.ReadWrite.All' for tenant settings )

There is granular permissions in Fabric however to get access to all the required areas would mean granting Fabric admin which also grants access to areas that the users should not get access.

Ideally we need a way to more granually assign API permissions or enable the use of custom roles for Fabric.

Hopefully this makes more sense, any questions please let me know.

[rohit1991 · Accepted solution]

Hi @ITmerrr ,

You've raised an important point. Currently, the limitation around custom roles not supporting Fabric-specific permissions does make it challenging to manage granular access—especially when dealing with sensitive areas like tenant settings. While there are some built-in layers of security in Fabric, such as workspace roles, item-level permissions, and OneLake data access controls, these do not fully address the need for fine-tuned administrative access.

As you mentioned, using delegated permissions via app registrations can help in some scenarios, but broader permissions like 'Tenant.ReadWrite.All' often grant more access than is necessary or desirable. This gap makes it difficult to follow the principle of least privilege. It would certainly be beneficial if Microsoft introduced more refined role-based access controls or scoped API permissions that target specific areas of the Fabric Admin Portal. Submitting this as feedback through the Microsoft Fabric Ideas portal might help bring more attention to the need for better administrative granularity.

Passionate about leveraging data analytics to drive strategic decision-making and foster business growth.

Connect with me on LinkedIn: Rohit Kumar.

[ITmerrr]

Thank you for replying.

I have now raised a idea link on the portal, please upvote 😊

https://community.fabric.microsoft.com/t5/Fabric-Ideas/Options-for-more-Granualar-permissions-to-are...

[ibarrau]

Hi. There are granular permission. I'm not sure what you are asking here.

Fabric has three security levels and they're evaluated sequentially to determine whether a user has data access. The order of evaluation for access is:

1. Microsoft Entra ID authentication: checks if the user can authenticate to the Azure identity and access management service, Microsoft Entra ID.
2. Fabric access: checks if the user can access Fabric.
3. Data security: checks if the user can perform the action they've requested on a table or file.

The third level, data security, has several building blocks that can be configured individually or together to align with different access requirements. The primary access controls in Fabric are:

• Workspace roles
• Item permissions
• Compute or granular permissions
• OneLake data access controls (preview)

If this doesn't cover your requirement, please add details on what you need to accomplish so we can check if it's possible.

I hope that helps,